Supabase stops auto-granting new tables on Oct 30. Don't fix the 42501 with GRANT ALL
On October 30, 2026 , Supabase stops granting anon , authenticated and service_role access to new tables in public on existing projects ( changelog ). A table created without an explicit GRANT returns 42501 permission denied through the Data API (PostgREST, GraphQL, supabase-js), even for service_role . Most write-ups stop at "add GRANTs to your migrations". This post is about what happens next:…
On October 30, 2026, Supabase will stop granting anonymous, authenticated and service_role access to new tables in public projects. If a table is created without an explicit GRANT, it will return a 42501 permission denied error, even for service_role. Most resources suggest adding GRANTs to migrations to fix this, but this could inadvertently reopen the vulnerability the change was meant to close. Existing tables are not affected by this change.
The issue arises because the anon role, which is used for unauthenticated visitors, has full access to newly created tables. This is a significant security risk as the anon key is included in the frontend bundle and can be exploited by anyone. While existing tables will retain their current GRANTs, any new tables or databases rebuilt from migrations will start with no GRANTs, leaving them completely inaccessible.
To address this, it's recommended to explicitly grant the necessary permissions to the appropriate roles after creating a table. This approach ensures that the table is protected while avoiding the pitfall of granting all permissions to the anon role.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
